Colorado SB 189: What the ADMT Disclosure Law Means for AI Product Teams

Colorado Resets Its AI Regulation

The original Colorado AI Act — SB 205, passed in 2024 — was one of the most ambitious state-level AI laws ever passed. It required risk management programs, annual impact assessments, and a broad duty of care. It also generated enormous industry pushback: developers and deployers argued the requirements were technically premature, compliance costs were disproportionate to risk, and the law’s scope was so broad it created more uncertainty than clarity.

SB 189 is the reset. Signed May 14, 2026, it repeals and reenacts the Colorado AI law with a fundamentally different philosophy: rather than requiring companies to prevent AI harm through governance programs before harm occurs, the new law requires companies to be transparent about AI use and give consumers recourse after an adverse outcome. This shift from preventive to corrective regulation is the central design choice that product teams need to internalize.

The law takes effect January 1, 2027 — giving affected companies approximately seven months to build compliance infrastructure into their AI product workflows.

What SB 189 Covers: The Scope Test

Not all AI systems trigger SB 189. The law applies to “Covered ADMT” — Automated Decision-Making Technology that materially influences a consequential decision about an individual.

A decision is consequential if it concerns any of these seven domains:

1. Education enrollment or opportunity
2. Employment or employment opportunity
3. Residential real estate lease or purchase in Colorado
4. Financial or lending services
5. Insurance (underwriting, pricing, coverage, or claims)
6. Healthcare services
7. Essential government services and public benefits

“Materially influences” means the AI is a meaningful input to the decision — not just a background analytics tool. A credit-scoring model that determines loan eligibility is clearly covered. A basic spreadsheet or a cybersecurity fraud detection system is explicitly excluded. Holland & Knight’s SB 189 analysis provides additional scope guidance, including the exclusion of legal services (which the prior law covered).

What Product Teams Must Build Before January 1, 2027

1. Pre-Use Notice Systems — Clear and Conspicuous Before Any Consequential Decision

Deployers must provide “clear and conspicuous” notice to consumers before a covered ADMT makes or materially influences a consequential decision. This notice must state that AI will be used, describe the nature of the decision, and explain how consumers can request additional information.

In practice: if your platform uses a credit-scoring model before approving a loan application, the consumer must receive notice before the model runs — not in a buried terms-of-service clause. The notice must be prominent, contextual, and plain-language. Product teams should treat this as a new UI element in any consequential decision workflow, not as a legal disclaimer. Design the notice as part of the user flow, not as a modal override.

2. Post-Adverse-Outcome Explanation Workflows — 30-Day Delivery Requirement

When a covered ADMT results in an adverse outcome for a consumer, the deployer has 30 days to deliver a plain-language explanation covering: what decision was made, the ADMT’s role in it, what data or categories of data were used, and how the consumer can exercise their rights (including requesting human review). The Consumer Finance Monitor’s SB 189 breakdown details the mandatory content of these notices.

This requires your engineering team to build two things: (a) a logging system that records which ADMT made which decision on which consumer at what time, and (b) an explanation generation workflow that can produce plain-language adverse-action notices for any stored decision within the 30-day window. Three-year record retention is mandatory.

3. Meaningful Human Review — Trained Reviewers with Override Authority

Consumers have the right to request meaningful human review following an adverse outcome. The law defines meaningful human review as requiring a human reviewer with actual knowledge of the ADMT’s operation, the ability to review the decision, and override authority. A rubber-stamp review by a helpdesk agent reading from a script does not satisfy this requirement. The reviewer must be trained, must understand the model’s role in the decision, and must have genuine decision authority.

For product teams, this means identifying who in your organization has this authority, training them on the ADMT’s operation, and building an intake workflow for human review requests that is responsive within a commercially reasonable timeframe. Morrison Foerster’s SB 189 analysis provides practical guidance on structuring human review programs.

Developer Obligations: The Supply Chain Dimension

SB 189 creates obligations for both developers (who build covered ADMT) and deployers (who deploy it to consumers). Developers must provide deployers with:

• A general description of intended uses and known harmful or inappropriate uses
• Categories of training data used
• Known limitations and risks
• Instructions for appropriate use and when human review is appropriate
• Material update notifications within reasonable timeframes

Developers must maintain records for three years and may share compliance information via public release notes — trade secrets need not be disclosed. This creates a new supply-chain transparency expectation: AI vendors selling into regulated decision domains will need to provide buyers with SB 189-compliant documentation packages, not just technical specifications.

Key Exemptions to Know

SB 189 carves out several categories where standard compliance obligations are modified:

• HIPAA-covered entities — special rules apply for healthcare data uses (non-employment)
• FDA-regulated medical devices — subject to existing FDA oversight rather than SB 189
• Cybersecurity and fraud prevention — explicitly excluded
• Insurance companies and financial institutions — existing regulatory frameworks govern; specific SB 189 requirements reduced
• Academic administration processes — excluded
• Basic tools — spreadsheets, static rule sets, and simple calculators are not “ADMT”

The Regulatory Question: What Comes Next for AI Disclosure Laws

Colorado’s reset from risk-based to disclosure-based regulation sets a precedent that will be watched by other states. The prior model — mandating governance programs before deployment — was technically ambitious and politically vulnerable. The new model — requiring transparency and recourse at point of harm — is easier to enforce, more legible to consumers, and politically more durable.

This shift mirrors the evolution of data breach notification laws: states began with complex preventive requirements, then converged on disclosure mandates that are more enforceable and consumer-friendly. AI regulation is likely following the same arc.

For global companies with U.S. operations, SB 189’s disclosure framework is significantly easier to comply with than the original AI Act — but it still requires genuine product and engineering investment. The seven-month runway to January 1, 2027 is sufficient if work begins immediately; it is not sufficient if treated as a 2027 problem.

Frequently Asked Questions

Sources & Further Reading

• Colorado Governor Signs SB 189, Significantly Amending the State’s AI Law — Holland & Knight
• Colorado Legislature Doubles Back on Risk-Based AI Act — National Law Review
• Colorado Rewrites Its Landmark AI Law — Consumer Finance Monitor
• Colorado Hits Reset on AI Regulation — Morrison Foerster
• Colorado AI Act Update: Key Changes in SB 26-189 — Clark Hill
• Colorado Legislature Passes Bill to Repeal and Replace Colorado AI Act — Troutman Privacy